In an environment in which methods of transmitting information are increasingly public and intertwined, protecting sensitive information has become critically important. Insuring confidentiality, privacy, and restricted access are primary concerns of both government and private organizations. Traditional methods of providing sufficient levels of security lag behind current needs and threaten to block implementation of new information and communication technologies. Furthermore, many methods currently being offered suffer in one or more of the following areas:                Require extremely large investments. While several secure network gateways, interface and VPN devices are available, most are so costly as to exclude them from consideration in all but the most critical applications. It is not uncommon to find devices that would be required at every workstation at a cost of several thousand (and, at times, several tens of thousands of) dollars per unit. Furthermore, most of these devices provide single functionality and must be physically removed or detached for any reconfiguration (providing little “bang for the buck”).        Inflexibility. Many current devices provide little if any flexibility in their use, while others offer some flexibility but with varying degrees of difficulty. VPNs either cannot be “re-keyed” to multiple, secure “conferences” or “logical networks”, or can only be re-keyed by physically removing or detaching the device. Very few if any provide the ability for a single user or workstation to communicate with multiple VPNs or to communicate through both secure and unsecure channels. Cryptographic algorithms are often pre-loaded and typically cannot be selected dynamically.        Limited Functionality. Most current devices are intended to provide one or two functions, often for a single application. A device provides data privacy but not access control or data separation. Some provide user authentication but cannot verify the authenticity of data received or of the apparent sender, while others do the opposite. Many work only in a Type 1 classified environment, while others can be used only for sensitive but unsecure information.        Extensive Network Infrastructure. Many (if not most) designs for protecting data-in-transit focus on securing the channels of communication rather than the information being communicated. These types of designs require, a priori, that all points between the originator and intended recipient of the data maintain the secure channel. Therefore, specialized hardware and/or software is required throughout the network, presenting extensive maintenance challenges and considerable cost. Furthermore, since these designs introduce multiple points of potential failure, considerably more hardware and maintenance efforts are needed for secondary backup systems, further complicating network design and inflating both initial and ongoing costs.        Extensive Key Management Infrastructure. Many designs require server-based certificate, user, and/or key directories and complicated systems for distribution, replication, authentication, and verification. Such systems are not only complicated to design and implement, but are suspect to load and performance requirements.        
If government and commercial organizations are going to be able to exploit the increasingly open networks and technologies, better methods of protecting the information sent through these networks are clearly needed. Although it is not believed that any one technology or any one application of technologies will provide a single complete solution for protecting data in transit, the use of a Constructive Key Management (CKM) system (see U.S. patent application Ser. No. 09/023,672) on a Network Interface Card (NIC) is capable of solving many of the existing challenges for a considerable number of potential applications.